v1.9.7

Changelog

• 3c0d818 fix(engine): bound substitution and eval nesting depth
• f407fe3 fix(engine): require a selector for durable allow rules
• b1d5e4f fix(hook): deny when headless_only approval is unavailable
• fa06581 fix(hook): evaluate apply_patch text as file content, not a command
• 5500566 fix(hook): reject pre-tool payloads that carry a tool response
• 40a01c7 fix(hook): require agreeing Cline patch aliases and name Codex patch targets
• 2e0bde8 fix(mcp): pass the command context to the rampart mcp -- shorthand
• 6b25eea fix(notify): extend credential redaction patterns
• 347ac39 fix(notify): keep token redaction unanchored
• 288dbd8 fix(policy): extend self-modification denies to remaining subcommands
• 5178314 fix(policy): match global flags before every CI self-modification subcommand
• d17c33b fix: redact session asks and escape approval text in rampart watch